On 14/10/16 01:57, Bruno Haible wrote:
> If pathconf (name, _PC_PATH_MAX) returns a PATH_MAX value > 2 GB,
> the readlink call in canonicalize-lgpl.c line 292 may return a length > 2 GB,
> therefore the implicit cast (assignment) to 'int' will produce a wrong value.
> If you agree with this patch, it'd be a good idea to propagate it into glibc
> (it's the file stdlib/canonicalize.c there).
There is a later cast to (long int) that would
similarly truncate large values on LLP64 systems.
How about something like this as well?
@@ -311,7 +312,7 @@ __realpath (const char *name, char *resolved)
len = strlen (end);
- if ((long int) (n + len) >= path_max)
+ if (SIZE_MAX - len <= n || path_max <= n + len)